Hacker News new | ask | show | jobs
by DisjointedHunt 1900 days ago
End to end encryption only stops Apple from seeing the location while it's moving "End to end" on each end, the Find My app itself or other device features almost certainly leack this information to Apple or it can be gotten through trivial effort if Apple wanted it.
1 comments
piva00 1900 days ago
Do you have any supporting evidence for these claims?
link
privacyking 1900 days ago
Well for example, it is well documented that although their messages in cloud feature is "end to end encrypted", as soon as you enable icloud phone backups, apple has access to all your messages. A similar issue likely arises with this.
link
DisjointedHunt 1900 days ago
Are you asking me if "End to End encryption" protects the data while at rest on each end?

If yes, please do your research on what that term means.

link
piva00 1900 days ago
No no! I'm very aware of what E2E means, etc., I'm asking if you have supporting evidence for this statement:

> the Find My app itself or other device features almost certainly leack this information to Apple

I asked if there was any evidence pointing to this leakage, I'd like to know if it's happened before and I'm unaware of it.

link
DisjointedHunt 1900 days ago
I can't seem to find traces of the original statements that went into much greater detail, but there is one case that sticks out, that of an Australian teen who accessed an internal system at Apple through unauthorized means and was on a Mac while doing so: https://www.theage.com.au/national/victoria/melbourne-teen-h...

The statements i recall strongly indicated that Apple was aware of many machine identifiers which would have been impossible to log otherwise such as the serial number of the system itself and other such revealing information.

If that is not convincing enough, there are plenty of tales of proprietary, unexposed APIs within the Apple stack itself that "ping home" with sensitive device information, the most recent example being one where any executable on a mac was deliberately blocked (a bug) until validated on Apples end.

If you are looking for a smoking gun, i'm afraid, i cannot provide that, and i apologize if that's what you took away from my comment.

On the other hand, as someone who understands software and the systems here, you may draw your own conclusions, given the two examples above on how hard it would be for someone at Apple, with a bit of motivation and access to do precisely this, ie, derive the information (inferred or direct) about device location through the find my app or other deeper layers of the stack where its stored, or, use the find my network to find devices such as MacBooks that they suspect were involved in activity their security teams dislike.

link